CVE-2022-36077: Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect
First published: Tue Nov 08 2022(Updated: )
The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.This issue has been patched in versions: 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7. Users are recommended to upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Electronjs Electron | <18.3.7 | |
| Electronjs Electron | >=19.0.0<19.0.11 | |
| Electronjs Electron | >=20.0.0<20.0.1 | |
| Electronjs Electron | =21.0.0 | |
| Electronjs Electron | =21.0.0-alpha1 | |
| Electronjs Electron | =21.0.0-alpha2 | |
| Electronjs Electron | =21.0.0-alpha3 | |
| Electronjs Electron | =21.0.0-alpha4 | |
| Electronjs Electron | =21.0.0-alpha5 | |
| Electronjs Electron | =21.0.0-alpha6 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-36077?
CVE-2022-36077 is a vulnerability in the Electron framework that allows exposure of sensitive information.
How does CVE-2022-36077 affect Electron?
CVE-2022-36077 affects versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7 of Electron.
What is the severity of CVE-2022-36077?
CVE-2022-36077 has a severity rating of 6.1, which is considered high.
How can I fix CVE-2022-36077?
To fix CVE-2022-36077, you should update to a version of Electron that is not vulnerable, such as version 21.0.0 or later.
Where can I find more information about CVE-2022-36077?
More information about CVE-2022-36077 can be found in the Electron framework's security advisory on GitHub: [link](https://github.com/electron/electron/security/advisories/GHSA-p2jh-44qj-pf2v)
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/author
- agent/last-modified-date
- agent/title
- agent/references
- agent/event
- agent/first-publish-date
- agent/description
- agent/tags
- vendor/electronjs
- canonical/electronjs electron
- version/electronjs electron/19.0.0
- version/electronjs electron/20.0.0
- version/electronjs electron/21.0.0
- version/electronjs electron/21.0.0-alpha1
- version/electronjs electron/21.0.0-alpha2
- version/electronjs electron/21.0.0-alpha3
- version/electronjs electron/21.0.0-alpha4
- version/electronjs electron/21.0.0-alpha5
- version/electronjs electron/21.0.0-alpha6
- vendor/microsoft
- canonical/microsoft windows